Hi Mirco, Sorry that I won't be quoting your entire email, as it is too long. I will quote-reply to the small bits where a misunderstanding is reasonably possible.
To your comments 1 & 2: - Because none of that would fly and I don't agree with it. You're free to bring up your suggestions as a separate proposal and see how it goes. :) - Because that would violate modern standards like NIST SP 800-63B-4 and OWASP ASVS 5 require supporting a length of 64 characters; Bcrypts limit is 72 *bytes*. Why is bcrypt-password-prehashing needed if Php also supports > PASSWORD_ARGON2I and PASSWORD_ARGON2ID out of the box? > Because Argon2 is not actually supported out of the box, due to its external dependencies. This is already mentioned in the RFC Introduction, though perhaps easy to miss; I'll try to remember adding it to the FAQ. > This goes against OWASP recommendations, see > > https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#bcrypt > >The bcrypt password hashing function should only be used for > >password storage in legacy systems where Argon2 and scrypt are not > >available. > OWASP recommends this because of Bcrypt's limitations, which bcrypt-wrap eliminates. This is also a point against your comments 1&2. Where is cshake256 defined? I did find SHAKE256 at > https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.202.pdf > But a *c*SHAKE256 is nowhere found? > cSHAKE is defined by NIST SP800-185: https://csrc.nist.gov/pubs/sp/800/185/final It is already linked by the RFC FAQ, though I probably could also add it to the references at the bottom: https://wiki.php.net/rfc/password_bcrypt_wrap#what_even_is_cshake256_it_sounds_exotic > The RFC states: > >HMAC-SHA512 output is truncated (yes, this is perfectly fine). The > >salt is part of the key. > ... and ... > >prehash_salt = "bcrypt-wrap:" || version || ":" || salt_raw > > The prehash_salt used in this RFC, is what OWASP calls pepper. The > prehash_salt is derived from the salt, and thus stored in the > database. Against OWASP recommendations. > No, it's not a pepper by anyone's definition, precisely because it's not secret. See also in the RFC FAQ: https://wiki.php.net/rfc/password_bcrypt_wrap#why_no_pepper https://wiki.php.net/rfc/password_bcrypt_wrap#isn_t_this_vulnerable_to_shucking > The RFC has no test-vectors. A re-implementation in e.g. C# can never > validate its correctness. Please add test-vectors. Also include > vectors that include smileys and other utf-8 symbols. Not just the > ASCII range. > At this stage, this is a PHP RFC that may undergo changes, and may or may not gather enough support. I'd be happy to work on a more formal specification at a later stage, but for the time being - the implementation PR is fully functional and includes many tests: https://github.com/php/php-src/pull/25040 ------------ The rest of your questions are already thoroughly and very explicitly answered in the RFC FAQ. Cheers, Andrey.
